資源傳播失敗：ClusterResourcePlacementOverridden 為 False

發行項
08/06/2024

本文討論如何在 Microsoft azure Kubernetes Fleet Manager 中使用ClusterResourcePlacement物件 API 來傳播資源時，針對問題進行疑難解答ClusterResourcePlacementOverridden。

徵兆

當您在 Azure Kubernetes Fleet Manager 中使用 ClusterResourcePlacement API 對象傳播資源時，部署會失敗。狀態 clusterResourcePlacementOverridden 會顯示為 False。

原因

此問題可能是因為 ClusterResourceOverride 或 ResourceOverride 是使用資源無效的欄位路徑所建立。

案例研究

在下列範例中，嘗試覆寫由 ClusterResourcePlacement 傳播至所選叢集的叢集角色secret-reader。不過， ClusterResourceOverride 會使用資源無效的路徑來建立。

ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"name":"secret-reader"},"rules":[{"apiGroups":[""],"resources":["secrets"],"verbs":["get","watch","list"]}]}
creationTimestamp: "2024-05-14T15:36:48Z"
name: secret-reader
resourceVersion: "81334"
uid: 108e6312-3416-49be-aa3d-a665c5df58b4
rules:
- apiGroups:
  - ""
    resources:
  - secrets
    verbs:
  - get
  - watch
  - list

ClusterRole secret-reader由傳播至成員叢集的 ClusterResourcePlacement。

ClusterResourceOverride 規格

spec:
  clusterResourceSelectors:
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: secret-reader
    version: v1
  policy:
    overrideRules:
    - clusterSelector:
        clusterSelectorTerms:
        - labelSelector:
            matchLabels:
              env: canary
      jsonPatchOverrides:
      - op: add
        path: /metadata/labels/new-label
        value: new-value

ClusterResourceOverride會藉由新增具有標籤 env: canary之叢集值new-value的新標籤（new-label）來建立，以覆寫 ClusterRole secret-reader 。

ClusterResourcePlacement 規格

spec:
  resourceSelectors:
    - group: rbac.authorization.k8s.io
      kind: ClusterRole
      name: secret-reader
      version: v1
  policy:
    placementType: PickN
    numberOfClusters: 1
    affinity:
      clusterAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          clusterSelectorTerms:
            - labelSelector:
                matchLabels:
                  env: canary
  strategy:
    type: RollingUpdate
    applyStrategy:
      allowCoOwnership: true

ClusterResourcePlacement 狀態：

status:
  conditions:
  - lastTransitionTime: "2024-05-14T16:16:18Z"
    message: found all cluster needed as specified by the scheduling policy, found
      1 cluster(s)
    observedGeneration: 1
    reason: SchedulingPolicyFulfilled
    status: "True"
    type: ClusterResourcePlacementScheduled
  - lastTransitionTime: "2024-05-14T16:16:18Z"
    message: All 1 cluster(s) start rolling out the latest resource
    observedGeneration: 1
    reason: RolloutStarted
    status: "True"
    type: ClusterResourcePlacementRolloutStarted
  - lastTransitionTime: "2024-05-14T16:16:18Z"
    message: Failed to override resources in 1 cluster(s)
    observedGeneration: 1
    reason: OverriddenFailed
    status: "False"
    type: ClusterResourcePlacementOverridden
  observedResourceIndex: "0"
  placementStatuses:
  - applicableClusterResourceOverrides:
    - cro-1-0
    clusterName: kind-cluster-1
    conditions:
    - lastTransitionTime: "2024-05-14T16:16:18Z"
      message: 'Successfully scheduled resources for placement in kind-cluster-1 (affinity
        score: 0, topology spread score: 0): picked by scheduling policy'
      observedGeneration: 1
      reason: Scheduled
      status: "True"
      type: Scheduled
    - lastTransitionTime: "2024-05-14T16:16:18Z"
      message: Detected the new changes on the resources and started the rollout process
      observedGeneration: 1
      reason: RolloutStarted
      status: "True"
      type: RolloutStarted
    - lastTransitionTime: "2024-05-14T16:16:18Z"
      message: 'Failed to apply the override rules on the resources: add operation
        does not apply: doc is missing path: "/metadata/labels/new-label": missing
        value'
      observedGeneration: 1
      reason: OverriddenFailed
      status: "False"
      type: Overridden
  selectedResources:
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: secret-reader
    version: v1

ClusterResourcePlacementOverridden如果條件為 False，請檢查 placementStatuses 區段以取得失敗的確切原因。

在此情況下，訊息表示覆寫失敗，因為路徑 /metadata/labels/new-label 及其對應的值遺失。根據先前的叢集角色 secret-reader範例，您可以看到路徑 /metadata/labels/ 不存在。這表示 labels 不存在。因此，無法新增標籤。

解決方法

若要成功覆寫叢集角色 secret-reader，請更正中的 ClusterResourceOverride路徑和值，如下列程式代碼所示：

jsonPatchOverrides:
  - op: add
    path: /metadata/labels
    value: 
      newlabel: new-value

這會將具有值new-value的新標籤newlabel新增至 ClusterRole secret-reader。

與我們連絡，以取得說明

如果您有問題或需要相關協助，請建立支援要求，或詢問 Azure community 支援。您也可以向 Azure 意見反應社群提交產品意見反應。

共用方式為